- tor-relays - lists.torproject.org

Running obfs4proxy on Debian Stable
by isis 22 Feb '15

22 Feb '15

Hello, I requested that the obfs4proxy package in Debian jessie be ported to wheezy-backports, [0] however, it seems this is extremely unlikely to happen because it would mean backporting pretty much every Golang package in existence. I would be super stoked if we could make it as easy and seamless as possible for the Bridge operators who are still running obfs2 (!!) to move to supporting better, newer Pluggable Transports. Currently recommended PTs to run are: obfs3, obfs4, scramblesuit, and fteproxy. When Tor Browser 4.5 becomes stable (probably in mid-April 2015), we'll want lots more obfs4 Bridges! For the super adventurous sysadmins who'd like to try Yawning's experimental new post-quantum PT, Basket [1] is one of the newest PTs. We should probably come up with some easy instructions for operators of Tor Bridge relays who are running Debian stable, such as adding an Apt pin to pull in only the obfs4proxy package and its dependencies from Debian jessie and keep everything else pinned to stable. If someone has done this, or has another simple solution, would you mind writing up some short how-to on the steps you took, please? [0]: http://lists.alioth.debian.org/pipermail/pkg-anonymity-tools/Week-of-Mon-20… [1]: https://github.com/yawning/basket -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://blog.patternsinthevoid.net/isis.txt

5 10

Tor relay only IPV6
by cmar433＠yandex.com 21 Feb '15

21 Feb '15

Hello, i try to run tor as relay .. but i have not any ipv4 adress.. is there any posibilities run tor as realy only for ipv6 adress ? for me seems is not functioning. (Debian wheezy) port 9001 is open but "conection refused" if i try IPV6 portscan I try open 22 only for test trough IPV6 portscan .. ist OK . port opened Any IDEA ? Thanks

4 4

load balance across multiple WAN?
by Rupert Roe 21 Feb '15

21 Feb '15

Hi, I currently run this middle node from a residental VDSL connection: https://atlas.torproject.org/#details/D0D6992508E64E28A77373B82798AB196BFA5… I am currently limited by the upload speed of my connection (~20MBit), I was wondering if I had another VDSL connection installed would I be able to load balance the upload of the relay across the two connections? Or would this mess up the routing for my relay? I.e. traffic comes in to the single published relay IP (which is OK as it's ~80MBit download). Then the relay can push ~40MBit upload load balanced across two 20MBit connections. Would it be problematic because the traffic would come from two different IPs, one of which does not match the published IP for the relay? I hope that question makes sense?? Thanks -- +447867537146 skype: rupertroe1 --

3 3

eventdns: Address mismatch on received DNS packet.
by Jeremy Olexa 21 Feb '15

21 Feb '15

Hi List, I'm seeing these messages in one of my relays. Pretty often, too. eventdns: Address mismatch on received DNS packet. Apparent source was <IP>:<port> I've searched this and found references[1] to a faulty resolver of some type and torservers.net ignores the message[2]. I use my ISPs resolvers which are physically close to the server. In an attempt to fix this, I've added a caching local resolver to my server and configured resolv.conf properly (problem persists). Then I switched to Google DNS with caching in front (problem persists). Can anyone clarify what the problem may be? Or is it no problem at all? [1]: https://lists.torproject.org/pipermail/tor-relays/2013-July/002209.html [2]: https://lists.torproject.org/pipermail/tor-relays/2011-December/001034.html Thanks! -Jeremy

6 5

(no subject)
by Volker Mink 20 Feb '15

20 Feb '15

3 2

Again Hibernations vs. limits, for the extreme case
by Filippo Valsorda 18 Feb '15

18 Feb '15

I run a relay with decently high bandwidth, but limited monthly transit (3TB out). https://globe.torproject.org/#/relay/2EC042F4274CC8A54381C78E8D1BF322FA26A0… I gathered from previous discussions that a fast node that goes into hibernation is more beneficial to the network than an artificially throttled node. So I set a hibernation limit and no speed limit. However, it looks like my node is fast enough to burn all the transit in a couple of days when it has consensus, and (1 month - 2 days) is enough time to get forgotten. So I'm probably stuck in a cycle of month 1. slowly ramp up speed and consensus; go into hibernation for a few days; lose the Guard flag (-> get more traffic); month 2. burn all the transit in 2 days go into hibernation for >25 days GOTO month 1 Is it still the case that I shouldn't put throttling in, even if this means that each other month I'll run at really low speed to ramp up consensus? Or should I combine the Hibernate setting with a reasonable limit of maybe 1 MB/s? Or maybe use daily limits in this case? (Please CC me, I might not read in-list-only replies) Thanks, Filippo

2 1

Re: [tor-relays] "Very Safe" Exit Policy
by Raynardine 18 Feb '15

18 Feb '15

On 02/18/2015 09:01 AM, Chris Patti wrote: > Bleah. > > Pesky humans:) Yes, it's always the problem of fitting imperfect components into a perfect system that ruins everyone's day. :P

1 0

"Very Safe" Exit Policy
by Stephen R Guglielmo 18 Feb '15

18 Feb '15

Hi list, I was looking for suggestions/discussion on very conservative policies for an exit relay. I run a relay now that is "reject *:*" and I wanted to open up a few exit ports. I don't want to open up major ports due to potential abuse issues. My server host states that, although they do allow Tor, there is a chance of the relay being terminated at their will [1]. I was considering using a whitelist exit policy and opening up only the following ports to be "safe": 43 - WHOIS protocol 53 - DNS 389 - LDAP 464,543,544,749 - Kerberos 531 - AOL IM 636 - LDAP over SSL 706 - SLIC 873 - rsync 5190 - ICQ and AOL Instant Messenger 5222,5223,5269,5280,5281,5298 - XMPP 5353 - Multicast DNS 5999 - CVSup 8332,8333 - Bitcoin 9091 -Transmission (BitTorrent client) Web Interface 11371 - OpenPGP key server 64738 - Mumble/Murmur I constructed the list based on a quick skimming of the WP ports list [2]. I suspect allowing IRC would eventually be grounds for my host to terminate my relay. This would be my first time running an exit relay and I'd be happy to hear advice and suggestions! Thanks, Steve [1] https://trac.torproject.org/projects/tor/wiki/doc/ISPCorrespondence#OVH [2] https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

9 11

new ansible-tor features: automatic instance configuration + automatic MyFamily generation (PATCH)
by Nusenu 18 Feb '15

18 Feb '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi David, thanks for creating ansible-tor. I added two features that are crucial to me and maybe useful for others as well. If you like it, feel free to merge - this is my first ansible experience and it is lightly tested. Example: lets say you have added a new server to your inventory. The server has 3 public IP addresses (1.1.1.1, 2.2.2.2, 3.3.3.3). After running ansible-tor with the new changes you will have the following 6 tor instances/ORPorts running (without manually specifying IP addresses first): 1.1.1.1:80 1.1.1.1:443 2.2.2.2:80 2.2.2.2:443 3.3.3.3:80 3.3.3.3:443 including MyFamily configuration across all servers/instances. regards, Nusenu changes ======= - - auto instance deployment without manual IP/ORPort configuration (new) starts 2 tor instances per available IP address by default makes manually specifying IP addresses and ORPorts via proc_instances obsolete ORPorts default to 80 and 443 (DirPort not added yet) replace "single.yml" + "instances.yml" -> instance.yml only (handles both cases dynamically) - - MyFamily autogeneration (new) Keeping all relay fingerprints in sync is probably one of the most annoying tasks for a relay operator managing multiple relays, now ansible takes care of this (all relays need to be in the 'relays' group) - - directory structure (changed) defaults: configs -> /etc/tor/<ip>_<orport>.torrc log dir -> /var/log/tor/<ip>_<orport>.log datadir -> /var/lib/tor/<ip>_<orport>/ pid dir -> /var/run/tor/<ip>_<orport>.pid (previously everything was located in /etc) - - added torrc sanity check (tor --verify-config ) (new) - - torrc files are owned by root (previously owned by $tor_user) - - the pid file check has been removed since the file is not required to exist (it will be created when tor starts) open - ----- - - it does not take care of instance removals yet (in case IPs are no longer available or amount of ORPorts have been reduced) - - allow opt-out -> only 1 tor instance per host (even if there are more IPs available) - - DirPort support - - detect RFC1918 IPs (opt-in) -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJU4i+CAAoJEFv7XvVCELh0y+kP/i4Mn/XClgXYloGdgWU9UPR+ Y8yZv97FvJOMPI40tccPKcNPcLQFRvGFYkR96sAOGoMfbJT/tQeH2dOxwAEF31mv afFkLsVPAOpNzlyO2qP1mkLtB/aYXtZ6jb2+JtpAhVBLKOVFBN2nNRiwdgFYZFGy f0ZIp7xyR9XcAhXo4nc0hlETREAnbMOgFGM6vqqIpJfimF3liE6va5HNw2CD+7Zd MmeIOuVNvQh09SiYf48AJpBeBRoybOvmFIPphtXEYlC/y6cd/IyUIYdOBuaLa5td vQnrQOC7TUgp74uarl0yaatOYOEagl0lrNeN6+Vgy5e0e12TgVccWW5ZosM1PBXG VH2FTfjHXUO+VN0p4xn6AS0dhWTRKb7isj3jpznTMsiq0AcvXM6DZjkzkcCPChVz jptdUbNvgpdP7j5X11iZniGpxVe7aFo2wCzgZORY1xMysiigJsL4M/nonr4YO4G9 w7kyNcco9gStklJSvOJXbfX4HrOCuWdq8hp4xubyON+5jpEUgMmG1o/v5NJANV4C CLzlz4kf9l9o351Z7DJQzilxzDEwe6oZwSWnsq+yB65Mgj5sUJnchi40iPLOHSUr DaVSSUxoZ8VVNYqqvGYb2fysYa7DsCgofsF/eXP4QyJp1WFNwc0ft6qIhyAGIDwx RfwQHrA+Lg95mdXDyr0B =QHkD -----END PGP SIGNATURE-----

4 15

Re: [tor-relays] new ansible-tor features: automatic instance configuration + automatic MyFamily generation (PATCH)
by Raynardine 17 Feb '15

17 Feb '15

On 02/17/2015 04:01 PM, Moritz Bartl wrote: > My algorithm. Hm. This all sucks because Tor still doesn't scale across > multiple cores. There should be more affordable dedicated host service providers that provide professionally overclocked servers. Liquid nitrogen isn't that expensive to generate, if you use solar power to make the electricity required more affordable. It seems dedicated servers are becoming less and less common as virtual private servers attract cheap customers. For things like Tor that are dumb and can only bind to a single core, overclocking and overvolting that one core professionally could be a practical business venture. Unfortunately, due to the nature of mixnets like Tor, unless a large number of equivalent service providers do it, the benefit provided is minimal at best. The Tor relay pool is strongest when the hosting providers are as diverse as possible. If 51% of Tor relays are hosted by the same company and in the same country, Tor may as well not exist.

1 0